Authentication is an important issue in many types of network communications. Many messages are meaningful only if the recipient can verify the identity of the sender. In some cases, the recipient associates a particular characteristic with a sender's identity. When a message is received that is known to come from that sender, the recipient refers to the characteristic in deciding what action to take. For example, a company employee associates the characteristic “authority to issue certain orders” with the company's president. Upon receiving the message “Take tomorrow off,” the employee treats the message with more respect if the message is known to come from the company president than if it came from an anonymous person. In another example, the recipient associates the characteristic “truth in reporting” with the identity of certain news outlets but not with other news outlets nor with the populace in general. Even if a message is received from a sender for whom the recipient has no pre-established association, the sender's identity may be meaningful in linking multiple messages together. For example, a police department receiving the message “False alarm: I'm not being robbed after all” would presumably accept the message at face value only if it could verify that the sender was indeed the same person who sent the earlier “Help! I'm being robbed!” message.
In network communications, an often used form of identity is the network address used by a device to identify itself on the network. Messages are typically tagged with this form of identity, which can be used by a recipient to address a message in response. However, a nefarious party may easily send a message with a deceptive sender's address. Without an authentication mechanism to verify that the sender's network address as contained in the message is actually the address where the message originated, this form of identity is vulnerable to fraudulent misrepresentation.
Protocols address the problem of fraudulent misrepresentation by implementing authentication services. The recipient of a message uses the authentication services to verify the identity of the sender of the message. The recipient then takes action based on the characteristics associated with the sender's identity. For example, the Internet Engineering Task Force Request for Comments (IETF RFC) 2401 “Security Architecture for the Internet Protocol” describes the use of IPsec authentication in restricting the acceptance of messages to those originating from authenticated senders. Other protocols provide similar authentication services. However, one perceived difficulty in implementing authentication is that some of these authentication services provide their security by means of quite complicated mechanisms. They come at a heavy perceived price in terms of a significant investment in administrative and communicative overhead.
The parent of the present application discloses a unilateral authentication mechanism that provides much of the security of heavyweight authentication mechanisms, but with lower administrative and communicative overhead. The present application discloses implementation options usable with the unilateral authentication mechanism and describes scenarios in which unilateral authentication may be profitably employed.